Exam MS-101 topic 2 question 77 discussion

Actual exam question from Microsoft's MS-101

Question #: 77
Topic #: 2

You have a Microsoft 365 tenant that contains a Windows 10 device. The device is onboarded to Microsoft Defender for Endpoint.
From Microsoft Defender Security Center, you perform a security investigation.
You need to run a PowerShell script on the device to collect forensic information.
Which action should you select on the device page?

A. Initiate Live Response Session
B. Initiate Automated Investigation
C. Collect investigation package
D. Go hunt

Show Suggested Answer

Suggested Answer: A 🗳️

by Johnnien at Nov. 14, 2021, 10:32 a.m.

Comments

Submit Cancel

Johnnien

Highly Voted 3 years, 7 months ago

Live response gives security operations teams instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats in real time. Live response is designed to enhance investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats.

upvoted 15 times

...